In many cases, the malicious apps were bogus versions of legitimate programs that had been recompiled to include malware, or as a Symantec researcher said last week, "Trojanized."

According to San Francisco-based smartphone security firm Lookout, between 50,000 and 200,000 copies of the apps were downloaded by users before Google yanked them from the Android Market.

Google has thrown the Android app "kill switch" only once before: In June 2010, it yanked a pair of apps it said were published by a security researcher, who "intentionally misrepresented their purpose in order to encourage user downloads."

In that case, however, the apps were not designed to be used maliciously, and did not request permission to access private data.

According to Lookout, which has been analyzing the infected apps since last week, the recently-pulled-and-uninstalled apps not only demanded extended permissions, but also made off with a wide range of information from the infected phones. Among the data pulled by the infected apps: the phone's IMSI (International Mobile Subscriber Identity) and IMEI (International Mobile Equipment Identity) numbers, unique identifiers of the subscriber and smartphone.

After one of the infected apps is downloaded and installed, the phone also surreptitiously downloads a second-stage with "one or two root exploits," said Kevin Mahaffey, the CTO of Lookout, that give attackers complete control of the device.

"I don't know if the hackers were joking when they named [the malware] DroidDream, but the second-stage only downloads between 11 p.m. and 8 a.m., when most users are asleep," said Mahaffey. He speculated that the timing was to insure users didn't notice any unexplained network activity while that stage was downloaded.

Besides pulling the kill switch, Google is also pushing an app of its own, dubbed "Android Market Security Tool March 2011," to all affected Android phones, said Rich Cannings, the head of Android's security team, in a blog post Sunday.

That app, which will be installed automatically no later than Tuesday on all Android phones whose owners had downloaded one or more of the malicious apps, prevents attackers from accessing any additional information by undoing the root access the malware obtained by exploiting vulnerabilities.

The Android Market Security Tool March 2011 does not patch the underlying bugs that were exploited by the malware-infected apps, said Mahaffey, but does appear to remove traces of the malicious code that aren't erased when the apps are uninstalled. Lookout is continuing to dig into Google's tool for more insight into its workings.

According to Google, Android 2.2.2 and earlier contains the bug, but later versions, including Android 2.3, aka "Gingerbread," do not.

Unlike Apple, Google does not distribute its own mobile operating system updates, whether security-related or otherwise, but relies on carriers to do so. Google launched Android 2.3 in December 2010, but as of mid-February, the bulk of Android phones -- nearly 90 per cent by Google's numbers -- were still running older, and thus vulnerable, versions of the operating system because carriers often take months to roll out Android updates.

"Google will change its model," said John Pescatore, a security analyst with Gartner Research, referring to Google's current practice of not vetting the apps listed in the market. In contrast, Apple closely reviews all apps that it places in its App Store, which is also the only sanctioned outlet for the iPhone.

"Google's search engine tells users when it suspects a site might be distributing malware," Pescatore noted. "That's what the market wants in a search engine and in mobile. People don't want to say, 'Oh oh, should I download this app?' They just want to say, 'That's a cool app, I'll download it.'"

Pescatore also knocked Google for resorting to pushing the security tool to users after the fact. "That's the worst of both worlds, if Google says 'We'll continue to let anything in the Market, but then says, 'Download this [anti-malware] app,'" said Pescatore. "Don't force us back to the bad ways of the PC.

"It's so much better to keep the bad stuff off in the first place," Pescatore said. "Come on, Google."

Mahaffey, however, applauded Google's decision to automatically install the tool. "Hats off to Google," he said today.

PCW Evaluation Team

As the Maserati or BMW of laptops, it would fit perfectly in the hands of a professional needing firepower under the hood, sophistication and class on the surface, and gaming prowess (sports mode if you will) in between.

This small mobile printer is exactly what I need for invoicing and other jobs such as sending fellow tradesman details or step-by-step instructions that I can easily print off from my phone or the Web.

Microsoft Office continues to make a student’s life that little bit easier by offering reliable, easy to use, time-saving functionality, while continuing to develop new features that further enhance what is already a formidable collection of applications

Reproduction in whole or in part in any form or medium without express written permission of IDG Communications is prohibited. Copyright 2013 IDG Communications.
ABN 14 001 592 650. All rights reserved.